Re: [PATCH] Audit of POSIX Message Queue Syscalls
On Wed, May 17, 2006 at 09:34:46AM -0400, Steve Grubb wrote:
> @@ -1242,6 +1313,187 @@ uid_t audit_get_loginuid(struct
audit_co
> }
>
> /**
> + * audit_mq_open - record audit data for a POSIX MQ open
> + * @oflag: open flag
> + * @mode: mode bits
> + * @u_attr: queue attributes
> + *
> + * Returns 0 for success or NULL context or < 0 on error.
> + */
> +int audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr)
> +{
> + struct audit_aux_data_mq_open *ax;
> + struct audit_context *context = current->audit_context;
> +
> + if (likely(!context))
> + return 0;
What if audit is not enabled? Need to check for it and bail out.
The audit_enabled flag is only checked once during syscall processing,
in audit_syscall_entry. Once we've made the decision to audit a
syscall, we don't re-check.
If audit_enabled was 0 in audit_syscall_entry, then
context->in_syscall will be 0. The latter is what you should check
along with !context.
Looking through the code, I see that audit_getname, audit_inode and
friends do both checks, while the other aux data collectors only check
!context. Looks like someone should add the second check for those
also (except maybe audit_avc_path). IIRC, we want the avc path
records even when syscall auditing is disabled.
Amy